Discuss joining the Open Regulatory Compliance Working Group

[tobie]

The Open Regulatory Compliance Working Group (ORC WG) is working with the open source community, the European Commission, industry organizations, and European Standards Organizations to help with the implementation of the Cyber Resilience Act.

Getting involved now could really help make sure that the compliance requirements won't conflict with the JavaScript ecosystem.

Full disclosure: the Eclipse Foundation is one of my company's clients, and I'm actively involved in driving the ORC WG.

[mcollina]

What's the relationship with the Commission? I guess we should be involved in whatever WG matters for the CRA to represent JS. I knew the LF was doing some kind of other initiatives, maybe @rginn can make the necessary intros.

Anyhow, we should have a good idea of how that matters for us and our projects.

[tobie]

I've given a lot more context in today's weekly call. I believe the recording will be shared here as soon as it is ready.

Relevant links:

• How to join the WG: https://orcwg.org/membership/ (it's free)
• Inventory of existing practices.

[bensternthal]

Below is a link to the recording of yesterday's call:

https://www.youtube.com/watch?v=SJDopxYmDEM

[tobie]

Hi folks, after spending more than a week in Brussels, I think being directly represented in the ORC working group is crucial for the JS community's specificities to be properly represented in the ongoing CRA-related standardization work.

I'm in a unique position to support the foundation in doing so as part of my role in ORC WG, the CRA Expert Group, and CEN/CENELEC WG9.

I'm happy to discuss next steps with you. These would include:

1. Adding relevant documents to the inventory we're collecting.
2. Bringing your questions to our FAQ
3. Writing a few key requirements of the JS community when it comes to security
4. Formally joining the ORC WG

There are upcoming deadlines in April for the standardization work that are critical not to miss, so I would suggest making a decision rather sooner than later. Such a decision doesn't prevent the foundation from also joining OpenSSF's effort.

/cc @rginn

[mcollina]

I'm +1

[UlisesGascon]

I am +1 too

[rginn]

.+1 from me. Joining the ORC working group is important for engaging with multiple stakeholders.